ITAR Compliance for Government Contractors

ITAR implements the Arms Export Control Act (AECA, 22 U.S.C. § 2778) and is administered by the Directorate of Defense Trade Controls (DDTC) within the U.S. Department of State. ITAR controls the export, re-export, temporary import, and brokering of defense articles, defense services, and related technical data. The regulations apply to all U.S. persons (citizens, permanent residents, and entities organized under U.S. law) as well as foreign persons within the United States.

A "defense article" under ITAR includes not only finished military equipment but also components, accessories, attachments, parts, firmware, software, and technical data related to items on the USML. "Technical data" encompasses blueprints, drawings, plans, instructions, documentation, and other information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles.

Critically, ITAR considers a "deemed export" to occur when technical data is disclosed to a foreign person, even within the United States. If a defense contractor shares USML technical data with a foreign national employee or visitor at its U.S. facility, that disclosure is treated as an export to the foreign person's home country and requires authorization.

Any person or entity that manufactures, exports, or temporarily imports defense articles or furnishes defense services must register with the Directorate of Defense Trade Controls (22 C.F.R. § 122.1). Registration is mandatory before applying for any export licenses and must be renewed annually. The registration fee structure ranges from approximately $2,250 to over $2,750 per year depending on the tier.

Registration is submitted through DDTC's online portal (DECCS — Defense Export Control and Compliance System). The registration statement requires disclosure of the applicant's ownership structure, foreign ownership or control, prior ITAR violations, criminal convictions, and the specific USML categories of articles manufactured or exported.

Registration with DDTC does not itself authorize any export. It is a prerequisite that establishes the registrant's eligibility to apply for export licenses and agreements. A company that manufactures ITAR-controlled items solely for domestic sale to the U.S. government is still required to register if its manufacturing activities fall within the USML, though it may request a limited registration.

A Technical Assistance Agreement (22 C.F.R. § 124.1) is required when a U.S. person will provide defense services or disclose technical data to a foreign person. TAAs are the most common authorization mechanism for defense contractors working with international partners, foreign subcontractors, or foreign government customers.

The TAA must identify the parties, the defense articles and technical data involved, the scope of the defense services, the foreign countries involved, the duration of the agreement, and any limitations or provisos. TAAs are submitted to DDTC for review and approval, which typically takes 30–90 days but can take significantly longer for complex or sensitive agreements.

Manufacturing License Agreements (MLA, 22 C.F.R. § 124.1) are a related but distinct authorization used when a foreign person will manufacture ITAR-controlled defense articles. MLAs involve a higher level of scrutiny because they authorize foreign production of U.S. defense technology.

Individual export licenses (DSP-5 for permanent exports, DSP-73 for temporary exports, DSP-61 for temporary imports) authorize specific shipments of defense articles to identified end users. License applications are submitted through DECCS and typically take 30–60 days for processing, though certain destinations and technologies require additional review by the Department of Defense, intelligence community, or other agencies.

ITAR provides several exemptions from licensing requirements. The most commonly used include § 126.4 (exports to Canada for certain unclassified items), § 125.4 (disclosures to employees of the U.S. government and its contractors performing under government contracts), and § 126.6 (foreign military sales through the U.S. government FMS program). Using an exemption without meeting all conditions constitutes an unauthorized export — contractors must carefully verify that every condition of the exemption is satisfied.

DDTC also issues "commodity jurisdiction" (CJ) determinations for items where it is unclear whether the item is controlled under ITAR (USML) or under the Commerce Department's EAR (Commerce Control List). CJ requests are submitted to DDTC, which makes the final determination in coordination with the Commerce Department and DoD.

ITAR violations carry some of the most severe penalties in federal regulation. Civil penalties can reach up to $1,000,000 per violation. Criminal penalties include fines up to $1,000,000 and imprisonment for up to 20 years per violation. In addition, violators may be debarred from all export privileges and excluded from government contracts.

Recent enforcement actions demonstrate the magnitude of ITAR penalties. Companies have paid consent agreements totaling tens and hundreds of millions of dollars for unauthorized exports, including inadvertent disclosures of technical data to foreign nationals and unauthorized re-exports by foreign subsidiaries. Even well-intentioned companies have faced multimillion-dollar penalties for compliance program failures.

DDTC encourages voluntary self-disclosure of ITAR violations. Companies that voluntarily disclose violations, cooperate with the investigation, and implement remedial compliance measures generally receive more favorable treatment than those whose violations are discovered through enforcement actions. However, voluntary disclosure does not guarantee immunity — significant penalties may still be imposed depending on the severity and scope of the violations.